Signals and Defense Engineer, Senior

What you'll do

• Investigate security alerts and potential incidents across endpoint, network, identity, cloud, and infrastructure environments.
• Perform incident triage to determine the scope, severity, impact, and root cause of security events.
• Support containment, eradication, and recovery activities during active cybersecurity incidents.
• Conduct proactive threat hunts using threat intelligence and adversary behaviors to identify detection gaps.
• Develop and execute threat hunting hypotheses aligned to the MITRE ATT&CK framework.
• Analyze large volumes of security telemetry to identify patterns, anomalies, and indicators of compromise.
• Translate investigation findings into actionable detection logic and new alerts for SOC monitoring teams.
• Document investigation findings, timelines, threat hunting methodologies, and recommended remediation actions.

What we're looking for

• U.S. citizenship is required.
• High school diploma or GED is required.
• 3+ years of experience in cybersecurity with hands-on responsibilities in threat hunting, incident response, security operations, detection engineering, or security investigations.
• Experience conducting hypothesis-driven threat hunts to identify malicious activity not detected by existing security controls.
• Experience analyzing endpoint, network, identity, cloud, application, and authentication telemetry to identify indicators of compromise.
• Experience using SIEM, EDR/XDR, or security data platforms to query and analyze large volumes of security telemetry.
• Experience using AI, machine learning, automation, or agentic security technologies to assist with security investigations or threat hunting.
• Experience with cloud security investigations across AWS, Azure, or GCP, including analysis of identity activity, audit logs, and workloads.
• Knowledge of adversary tactics, techniques, and procedures, including practical application of the MITRE ATT&CK framework.
• Knowledge of Windows and Linux environments, including analysis of system logs, processes, and common forensic artifacts.
• Experience with scripting or automation using technologies such as Python, PowerShell, Bash, or SQL (preferred).
• Experience with cloud incident response and forensic techniques involving containers, Kubernetes, Docker, or serverless workloads (preferred).
• Experience performing network analysis using packet captures, Zeek, DNS telemetry, or proxy data (preferred).
• Experience with malware analysis, digital forensics, endpoint investigation, or memory and disk artifact analysis (preferred).
• Bachelor’s degree in Cybersecurity, CS, Information Systems, Engineering, or a related field (preferred).